How the campaign worked

More than 70,000 credentials were harvested from internet-facing Fortinet and Palo Alto Networks devices in a large-scale campaign detailed by researchers at Group-IB and NyxLab. The operation, attributed to an actor tracked as k0t, targeted exposed FortiGate firewalls and GlobalProtect VPN systems around the world, and in some cases led to persistent remote access and data theft.

According to the researchers, the operator used public scanners, custom exploits and brute force to gain VPN footholds, exploiting FortiWeb path traversal flaw CVE-2025-64446 and a PAN-OS GlobalProtect authentication bypass, CVE-2026-0257. Once inside, the actor relied on legitimate administration and penetration-testing tools such as NetExec, Impacket, Kerbrute and Mimikatz to move deeper, persisted with OpenConnect VPN, MeshCentral agents and AdaptixC2, and exfiltrated data with Rclone. The researchers say a significant share of the compromises happened between February and June 2026, with nearly 38 per cent of victims in Asia Pacific, 31.9 per cent in Latin America, 15.8 per cent in Europe and 12.7 per cent in the Middle East and North Africa.

The ransomware connection

The researchers link k0t, also associated with the names CryptoFeel, Member19 and QazWsxShop, to ransomware groups including Qilin and The Gentlemen, with several victims later appearing on ransomware leak sites. They note the harvested dataset barely overlaps with the earlier FortiBleed incident, marking k0t as a separate operation. For organisations running exposed Fortinet or Palo Alto gear, the researchers' advice is blunt: patch the named flaws, restrict management interfaces from the internet, and rotate every stored credential, since harvested logins can outlive the original intrusion.

Sources: The Hacker News (Group-IB and NyxLab research) | Punk Report